Loading vulnerability…
Netty WebSocket08FrameDecoder Memory-Exhaustion Denial of Service
CVE-2014-0193 is an uncontrolled memory-consumption vulnerability in Netty's WebSocket08FrameDecoder during WebSocket fragmented-message aggregation. Netty versions 3.6.x before 3.6.9, 3.7.x before 3.7.1, 3.8.x before 3.8.2, 3.9.x before 3.9.1, and 4.0.x before 4.0.19 can aggregate a TextWebSocketFrame followed by an excessively long sequence of ContinuationWebSocketFrames without adequately bounding memory use. A remote peer can cause an OutOfMemoryError by maintaining the fragmented message stream.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A remote attacker can exhaust heap memory in a vulnerable Netty WebSocket service, triggering an OutOfMemoryError. Depending on application and server configuration, this can terminate or destabilize the affected service and cause denial of service.
If you can’t patch tonight, do this now.
Where immediate upgrade is not possible, restrict WebSocket endpoint exposure to trusted clients and networks. Enforce maximum WebSocket message and frame sizes, fragmentation limits, connection and idle timeouts, and per-client connection/message rate limits at the application layer or an intervening reverse proxy/load balancer. Monitor heap utilization and WebSocket connection behavior for sustained continuation-frame streams.
Patch, then assume compromise.
Upgrade Netty to a fixed release: 3.6.9.Final or later in the 3.6 branch, 3.7.1.Final or later in the 3.7 branch, 3.8.2.Final or later in the 3.8 branch, 3.9.1.Final or later in the 3.9 branch, or 4.0.19.Final or later in the 4.0 branch. For netty-all 4.0.x, upgrade to 4.0.19.Final or later. Apply the corresponding supported vendor update for products embedding affected Netty versions and restart affected application-server processes as required.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
23 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.